Index: lib/Transforms/InstCombine/InstCombineVectorOps.cpp
===================================================================
--- lib/Transforms/InstCombine/InstCombineVectorOps.cpp
+++ lib/Transforms/InstCombine/InstCombineVectorOps.cpp
@@ -1171,7 +1171,14 @@
       SmallVector<Value*, 8> NewOps;
       bool NeedsRebuild = (Mask.size() != I->getType()->getVectorNumElements());
       for (int i = 0, e = I->getNumOperands(); i != e; ++i) {
-        Value *V = evaluateInDifferentElementOrder(I->getOperand(i), Mask);
+        Value *V;
+        // Recursively call evaluateInDifferentElementOrder on vector arguments
+        // as well. E.g. GetElementPtr may have scalar operands even if the
+        // return value is a vector, so we need to examine the operand type.
+        if (I->getOperand(i)->getType()->isVectorTy())
+          V = evaluateInDifferentElementOrder(I->getOperand(i), Mask);
+        else
+          V = I->getOperand(i);
         NewOps.push_back(V);
         NeedsRebuild |= (V != I->getOperand(i));
       }
Index: test/Transforms/InstCombine/vec_gep_scalar_arg.ll
===================================================================
--- /dev/null
+++ test/Transforms/InstCombine/vec_gep_scalar_arg.ll
@@ -0,0 +1,27 @@
+; RUN: opt -instcombine -S < %s | FileCheck %s
+
+define void @f1() {
+entry:
+  %b = alloca [2 x [4 x i16]], align 1
+  %tmp1 = getelementptr inbounds [2 x [4 x i16]], [2 x [4 x i16]]* %b, i32 0, i32 1
+  %.splatinsert = insertelement <4 x [4 x i16]*> undef, [4 x i16]* %tmp1, i32 0
+  %.splat = shufflevector <4 x [4 x i16]*> %.splatinsert, <4 x [4 x i16]*> undef, <4 x i32> zeroinitializer
+  %tmp2 = getelementptr inbounds [4 x i16], <4 x [4 x i16]*> %.splat, i32 0, i32 3
+  %tmp3 = extractelement <4 x i16*> %tmp2, i32 3
+  br label %for.cond.cleanup
+
+for.cond.cleanup:                                 ; preds = %entry
+  %broadcast.splatinsert22 = insertelement <4 x i16*> undef, i16* %tmp3, i32 0
+  %broadcast.splat23 = shufflevector <4 x i16*> %broadcast.splatinsert22, <4 x i16*> undef, <4 x i32> zeroinitializer
+  %tmp0 = ptrtoint <4 x i16*> %broadcast.splat23 to <4 x i16>
+  ret void
+}
+
+; Reproducer for PR41270. Everything should go away, and we shouldn't crash.
+
+; CHECK-LABEL: @f1
+; CHECK-LABEL: entry:
+; CHECK-NEXT:    br label %for.cond.cleanup
+
+; CHECK-LABEL: for.cond.cleanup:
+; CHECK-NEXT:    ret void